code.delx.au - refind/blob - install.sh

   1 #!/bin/bash
   2 #
   3 # Linux/MacOS X script to install rEFInd
   4 #
   5 # Usage:
   6 #
   7 # ./install.sh [options]
   8 #
   9 # options include:
  10 #    "--esp" to install to the ESP rather than to the system's root
  11 #           filesystem. This is the default on Linux
  12 #    "--usedefault {devicefile}" to install as default
  13 #           (/EFI/BOOT/BOOTX64.EFI and similar) to the specified device
  14 #           (/dev/sdd1 or whatever) without registering with the NVRAM.
  15 #    "--alldrivers" to install all drivers along with regular files
  16 #    "--nodrivers" to suppress driver installation (default in Linux is
  17 #           driver used on /boot; --nodrivers is OS X default)
  18 #    "--shim {shimfile}" to install a shim.efi file for Secure Boot
  19 #    "--localkeys" to re-sign x86-64 binaries with a locally-generated key
  20 #
  21 # The "esp" option is valid only on Mac OS X; it causes
  22 # installation to the EFI System Partition (ESP) rather than
  23 # to the current OS X boot partition. Under Linux, this script
  24 # installs to the ESP by default.
  25 #
  26 # This program is copyright (c) 2012 by Roderick W. Smith
  27 # It is released under the terms of the GNU GPL, version 3,
  28 # a copy of which should be included in the file COPYING.txt.
  29 #
  30 # Revision history:
  31 #
  32 # 0.6.9   -- Install gptsync on Macs if evidence of Windows found
  33 # 0.6.8   -- Bug fix: ESP scan now uses "uniq".
  34 # 0.6.6   -- Bug fix: Upgrade drivers when installed to EFI/BOOT. Also enable
  35 #            copying shim.efi and MokManager.efi over themselves.
  36 # 0.6.4   -- Copies ext2 driver rather than ext4 driver for ext2/3fs
  37 # 0.6.3   -- Support for detecting rEFInd in EFI/BOOT and EFI/Microsoft/Boot
  38 #            directories & for installing to EFI/BOOT in BIOS mode
  39 # 0.6.2-1 -- Added --yes option & tweaked key-copying for use with RPM install script
  40 # 0.6.1   -- Added --root option; minor bug fixes
  41 # 0.6.0   -- Changed --drivers to --alldrivers and added --nodrivers option;
  42 #            changed default driver installation behavior in Linux to install
  43 #            the driver needed to read /boot (if available)
  44 # 0.5.1.2 -- Fixed bug that caused failure to generate refind_linux.conf file
  45 # 0.5.1.1 -- Fixed bug that caused script failure under OS X
  46 # 0.5.1   -- Added --shim & --localkeys options & create sample refind_linux.conf
  47 #            in /boot
  48 # 0.5.0   -- Added --usedefault & --drivers options & changed "esp" option to "--esp"
  49 # 0.4.5   -- Fixed check for rEFItBlesser in OS X
  50 # 0.4.2   -- Added notice about BIOS-based OSes & made NVRAM changes in Linux smarter
  51 # 0.4.1   -- Added check for rEFItBlesser in OS X
  52 # 0.3.3.1 -- Fixed OS X 10.7 bug; also works as make target
  53 # 0.3.2.1 -- Check for presence of source files; aborts if not present
  54 # 0.3.2   -- Initial version
  55 #
  56 # Note: install.sh version numbers match those of the rEFInd package
  57 # with which they first appeared.
  58
  59 RootDir="/"
  60 TargetDir=/EFI/refind
  61 LocalKeysBase="refind_local"
  62 ShimSource="none"
  63 TargetShim="default"
  64 TargetX64="refind_x64.efi"
  65 TargetIA32="refind_ia32.efi"
  66 LocalKeys=0
  67 DeleteRefindDir=0
  68 AlwaysYes=0
  69
  70 #
  71 # Functions used by both OS X and Linux....
  72 #
  73
  74 GetParams() {
  75    InstallToEspOnMac=0
  76    if [[ $OSName == "Linux" ]] ; then
  77       # Install the driver required to read /boot, if it's available
  78       InstallDrivers="boot"
  79    else
  80       InstallDrivers="none"
  81    fi
  82    while [[ $# -gt 0 ]]; do
  83       case $1 in
  84          --esp | --ESP) InstallToEspOnMac=1
  85               ;;
  86          --usedefault) TargetDir=/EFI/BOOT
  87               TargetPart=$2
  88               TargetX64="bootx64.efi"
  89               TargetIA32="bootia32.efi"
  90               shift
  91               ;;
  92          --root) RootDir=$2
  93               shift
  94               ;;
  95          --localkeys) LocalKeys=1
  96               ;;
  97          --shim) ShimSource=$2
  98               shift
  99               ;;
 100          --drivers | --alldrivers) InstallDrivers="all"
 101               ;;
 102          --nodrivers) InstallDrivers="none"
 103               ;;
 104          --yes) AlwaysYes=1
 105               ;;
 106          * ) echo "Usage: $0 [--esp | --usedefault {device-file} | --root {directory} ]"
 107              echo "                  [--nodrivers | --alldrivers] [--shim {shim-filename}]"
 108              echo "                  [--localkeys] [--yes]"
 109              exit 1
 110       esac
 111       shift
 112    done
 113
 114    if [[ $InstallToEspOnMac == 1 && $TargetDir == '/EFI/BOOT' ]] ; then
 115       echo "You may use --esp OR --usedefault, but not both! Aborting!"
 116       exit 1
 117    fi
 118    if [[ $RootDir != '/' && $TargetDir == '/EFI/BOOT' ]] ; then
 119       echo "You may use --usedefault OR --root, but not both! Aborting!"
 120       exit 1
 121    fi
 122    if [[ $RootDir != '/' && $InstallToEspOnMac == 1 ]] ; then
 123       echo "You may use --root OR --esp, but not both! Aborting!"
 124       exit 1
 125    fi
 126
 127    RLConfFile="$RootDir/boot/refind_linux.conf"
 128    EtcKeysDir="$RootDir/etc/refind.d/keys"
 129 } # GetParams()
 130
 131 # Get a yes/no response from the user and place it in the YesNo variable.
 132 # If the AlwaysYes variable is set to 1, skip the user input and set "Y"
 133 # in the YesNo variable.
 134 ReadYesNo() {
 135    if [[ $AlwaysYes == 1 ]] ; then
 136       YesNo="Y"
 137       echo "Y"
 138    else
 139       read YesNo
 140    fi
 141 }
 142
 143 # Abort if the rEFInd files can't be found.
 144 # Also sets $ConfFile to point to the configuration file,
 145 # $IconsDir to point to the icons directory, and
 146 # $ShimSource to the source of the shim.efi file (if necessary).
 147 CheckForFiles() {
 148    # Note: This check is satisfied if EITHER the 32- or the 64-bit version
 149    # is found, even on the wrong platform. This is because the platform
 150    # hasn't yet been determined. This could obviously be improved, but it
 151    # would mean restructuring lots more code....
 152    if [[ ! -f $RefindDir/refind_ia32.efi && ! -f $RefindDir/refind_x64.efi ]] ; then
 153       echo "The rEFInd binary file is missing! Aborting installation!"
 154       exit 1
 155    fi
 156
 157    if [[ -f $RefindDir/refind.conf-sample ]] ; then
 158       ConfFile=$RefindDir/refind.conf-sample
 159    elif [[ -f $ThisDir/refind.conf-sample ]] ; then
 160       ConfFile=$ThisDir/refind.conf-sample
 161    else
 162       echo "The sample configuration file is missing! Aborting installation!"
 163       exit 1
 164    fi
 165
 166    if [[ -d $RefindDir/icons ]] ; then
 167       IconsDir=$RefindDir/icons
 168    elif [[ -d $ThisDir/icons ]] ; then
 169       IconsDir=$ThisDir/icons
 170    else
 171       echo "The icons directory is missing! Aborting installation!"
 172       exit 1
 173    fi
 174
 175    if [[ $ShimSource != "none" ]] ; then
 176       if [[ -f $ShimSource ]] ; then
 177          TargetX64="grubx64.efi"
 178          MokManagerSource=`dirname $ShimSource`/MokManager.efi
 179       else
 180          echo "The specified shim file, $ShimSource, doesn't exist!"
 181          echo "Aborting installation!"
 182          exit 1
 183       fi
 184    fi
 185 } # CheckForFiles()
 186
 187 # Helper for CopyRefindFiles; copies shim files (including MokManager, if it's
 188 # available) to target.
 189 CopyShimFiles() {
 190    cp -fb $ShimSource $InstallDir/$TargetDir/$TargetShim
 191    if [[ $? != 0 ]] ; then
 192       Problems=1
 193    fi
 194    if [[ -f $MokManagerSource ]] ; then
 195       cp -fb $MokManagerSource $InstallDir/$TargetDir/
 196    fi
 197    if [[ $? != 0 ]] ; then
 198       Problems=1
 199    fi
 200 } # CopyShimFiles()
 201
 202 # Copy the public keys to the installation medium
 203 CopyKeys() {
 204    if [[ $LocalKeys == 1 ]] ; then
 205       mkdir -p $InstallDir/$TargetDir/keys/
 206       cp $EtcKeysDir/$LocalKeysBase.cer $InstallDir/$TargetDir/keys/
 207       cp $EtcKeysDir/$LocalKeysBase.crt $InstallDir/$TargetDir/keys/
 208 #    else
 209 #       cp $ThisDir/refind.cer $InstallDir/$TargetDir/keys/
 210 #       cp $ThisDir/refind.crt $InstallDir/$TargetDir/keys/
 211    fi
 212 } # CopyKeys()
 213
 214 # Copy drivers from $RefindDir/drivers_$1 to $InstallDir/$TargetDir/drivers_$1,
 215 # honoring the $InstallDrivers condition. Must be passed a suitable
 216 # architecture code (ia32 or x64).
 217 CopyDrivers() {
 218    if [[ $InstallDrivers == "all" ]] ; then
 219       mkdir -p $InstallDir/$TargetDir/drivers_$1
 220       cp $RefindDir/drivers_$1/*_$1.efi $InstallDir/$TargetDir/drivers_$1/ 2> /dev/null
 221       cp $ThisDir/drivers_$1/*_$1.efi $InstallDir/$TargetDir/drivers_$1/ 2> /dev/null
 222    elif [[ $InstallDrivers == "boot" && -x `which blkid` ]] ; then
 223       BootPart=`df /boot | grep dev | cut -f 1 -d " "`
 224       BootFS=`blkid -o export $BootPart 2> /dev/null | grep TYPE= | cut -f 2 -d =`
 225       DriverType=""
 226       case $BootFS in
 227          ext2 | ext3) DriverType="ext2"
 228               # Could use ext4, but that can create unwanted entries from symbolic
 229               # links in / to /boot/vmlinuz if a separate /boot partition is used.
 230               ;;
 231          ext4) DriverType="ext4"
 232               ;;
 233          reiserfs) DriverType="reiserfs"
 234               ;;
 235          hfsplus) DriverType="hfs"
 236               ;;
 237          *) BootFS=""
 238       esac
 239       if [[ -n $BootFS ]] ; then
 240          echo "Installing driver for $BootFS (${DriverType}_$1.efi)"
 241          mkdir -p $InstallDir/$TargetDir/drivers_$1
 242          cp $RefindDir/drivers_$1/${DriverType}_$1.efi $InstallDir/$TargetDir/drivers_$1/ 2> /dev/null
 243          cp $ThisDir/drivers_$1/${DriverType}_$1.efi $InstallDir/$TargetDir/drivers_$1/ 2> /dev/null
 244       fi
 245    fi
 246 }
 247
 248 # Copy tools (currently only gptsync, and that only on Macs) to the EFI/tools
 249 # directory on the ESP. Must be passed a suitable architecture code (ia32
 250 # or x64).
 251 CopyTools() {
 252    mkdir -p $InstallDir/EFI/tools
 253    if [[ $OSName == 'Darwin' ]] ; then
 254       cp -f $RefindDir/tools_$1/gptsync_$1.efi $InstallDir/EFI/tools/
 255    fi
 256 } # CopyTools()
 257
 258 # Copy the rEFInd files to the ESP or OS X root partition.
 259 # Sets Problems=1 if any critical commands fail.
 260 CopyRefindFiles() {
 261    mkdir -p $InstallDir/$TargetDir
 262    if [[ $TargetDir == '/EFI/BOOT' ]] ; then
 263       cp $RefindDir/refind_ia32.efi $InstallDir/$TargetDir/$TargetIA32 2> /dev/null
 264       if [[ $? != 0 ]] ; then
 265          echo "Note: IA32 (x86) binary not installed!"
 266       fi
 267       cp $RefindDir/refind_x64.efi $InstallDir/$TargetDir/$TargetX64 2> /dev/null
 268       if [[ $? != 0 ]] ; then
 269          Problems=1
 270       fi
 271       if [[ $ShimSource != "none" ]] ; then
 272          TargetShim="bootx64.efi"
 273          CopyShimFiles
 274       fi
 275       if [[ $InstallDrivers == "all" ]] ; then
 276          cp -r $RefindDir/drivers_* $InstallDir/$TargetDir/ 2> /dev/null
 277          cp -r $ThisDir/drivers_* $InstallDir/$TargetDir/ 2> /dev/null
 278       elif [[ $Upgrade == 1 ]] ; then
 279          if [[ $Platform == 'EFI64' ]] ; then
 280             CopyDrivers x64
 281             CopyTools x64
 282          else
 283             CopyDrivers ia32
 284             CopyTools ia32
 285          fi
 286       fi
 287       Refind=""
 288       CopyKeys
 289    elif [[ $Platform == 'EFI64' || $TargetDir == "/EFI/Microsoft/Boot" ]] ; then
 290       cp $RefindDir/refind_x64.efi $InstallDir/$TargetDir/$TargetX64
 291       if [[ $? != 0 ]] ; then
 292          Problems=1
 293       fi
 294       CopyDrivers x64
 295       CopyTools x64
 296       Refind="refind_x64.efi"
 297       CopyKeys
 298       if [[ $ShimSource != "none" ]] ; then
 299          if [[ $TargetShim == "default" ]] ; then
 300             TargetShim=`basename $ShimSource`
 301          fi
 302          CopyShimFiles
 303          Refind=$TargetShim
 304          if [[ $LocalKeys == 0 ]] ; then
 305             echo "Storing copies of rEFInd Secure Boot public keys in $EtcKeysDir"
 306             mkdir -p $EtcKeysDir
 307             cp $ThisDir/keys/refind.cer $EtcKeysDir 2> /dev/null
 308             cp $ThisDir/keys/refind.crt $EtcKeysDir 2> /dev/null
 309          fi
 310       fi
 311    elif [[ $Platform == 'EFI32' ]] ; then
 312       cp $RefindDir/refind_ia32.efi $InstallDir/$TargetDir/$TargetIA32
 313       if [[ $? != 0 ]] ; then
 314          Problems=1
 315       fi
 316       CopyDrivers ia32
 317       CopyTools ia32
 318       Refind="refind_ia32.efi"
 319    else
 320       echo "Unknown platform! Aborting!"
 321       exit 1
 322    fi
 323    echo "Copied rEFInd binary files"
 324    echo ""
 325    if [[ -d $InstallDir/$TargetDir/icons ]] ; then
 326       rm -rf $InstallDir/$TargetDir/icons-backup &> /dev/null
 327       mv -f $InstallDir/$TargetDir/icons $InstallDir/$TargetDir/icons-backup
 328       echo "Notice: Backed up existing icons directory as icons-backup."
 329    fi
 330    cp -r $IconsDir $InstallDir/$TargetDir
 331    if [[ $? != 0 ]] ; then
 332       Problems=1
 333    fi
 334    mkdir -p $InstallDir/$TargetDir/keys
 335    cp -rf $ThisDir/keys/*.[cd]er $InstallDir/$TargetDir/keys/ 2> /dev/null
 336    cp -rf $EtcKeysDir/*.[cd]er $InstallDir/$TargetDir/keys/ 2> /dev/null
 337    if [[ -f $InstallDir/$TargetDir/refind.conf ]] ; then
 338       echo "Existing refind.conf file found; copying sample file as refind.conf-sample"
 339       echo "to avoid overwriting your customizations."
 340       echo ""
 341       cp -f $ConfFile $InstallDir/$TargetDir
 342       if [[ $? != 0 ]] ; then
 343          Problems=1
 344       fi
 345    else
 346       echo "Copying sample configuration file as refind.conf; edit this file to configure"
 347       echo "rEFInd."
 348       echo ""
 349       cp -f $ConfFile $InstallDir/$TargetDir/refind.conf
 350       if [[ $? != 0 ]] ; then
 351          Problems=1
 352       fi
 353    fi
 354    if [[ $DeleteRefindDir == 1 ]] ; then
 355       echo "Deleting the temporary directory $RefindDir"
 356       rm -r $RefindDir
 357    fi
 358 } # CopyRefindFiles()
 359
 360 # Mount the partition the user specified with the --usedefault option
 361 MountDefaultTarget() {
 362    InstallDir=/tmp/refind_install
 363    mkdir -p $InstallDir
 364    if [[ $OSName == 'Darwin' ]] ; then
 365       mount -t msdos $TargetPart $InstallDir
 366    elif [[ $OSName == 'Linux' ]] ; then
 367       mount -t vfat $TargetPart $InstallDir
 368    fi
 369    if [[ $? != 0 ]] ; then
 370       echo "Couldn't mount $TargetPart ! Aborting!"
 371       rmdir $InstallDir
 372       exit 1
 373    fi
 374    UnmountEsp=1
 375 } # MountDefaultTarget()
 376
 377 #
 378 # A series of OS X support functions....
 379 #
 380
 381 # Mount the ESP at /Volumes/ESP or determine its current mount
 382 # point.
 383 # Sets InstallDir to the ESP mount point
 384 # Sets UnmountEsp if we mounted it
 385 MountOSXESP() {
 386    # Identify the ESP. Note: This returns the FIRST ESP found;
 387    # if the system has multiple disks, this could be wrong!
 388    Temp=`diskutil list | grep " EFI "`
 389    Esp=/dev/`echo $Temp | cut -f 5 -d ' '`
 390    # If the ESP is mounted, use its current mount point....
 391    Temp=`df | grep $Esp`
 392    InstallDir=`echo $Temp | cut -f 6 -d ' '`
 393    if [[ $InstallDir == '' ]] ; then
 394       mkdir /Volumes/ESP &> /dev/null
 395       mount -t msdos $Esp /Volumes/ESP
 396       if [[ $? != 0 ]] ; then
 397          echo "Unable to mount ESP! Aborting!\n"
 398          exit 1
 399       fi
 400       UnmountEsp=1
 401       InstallDir="/Volumes/ESP"
 402    fi
 403 } # MountOSXESP()
 404
 405 # Control the OS X installation.
 406 # Sets Problems=1 if problems found during the installation.
 407 InstallOnOSX() {
 408    echo "Installing rEFInd on OS X...."
 409    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 410       MountDefaultTarget
 411    elif [[ $InstallToEspOnMac == "1" ]] ; then
 412       MountOSXESP
 413    else
 414       InstallDir="$RootDir/"
 415    fi
 416    echo "Installing rEFInd to the partition mounted at '$InstallDir'"
 417    Platform=`ioreg -l -p IODeviceTree | grep firmware-abi | cut -d "\"" -f 4`
 418    CopyRefindFiles
 419    if [[ $InstallToEspOnMac == "1" ]] ; then
 420       bless --mount $InstallDir --setBoot --file $InstallDir/$TargetDir/$Refind
 421    elif [[ $TargetDir != "/EFI/BOOT" ]] ; then
 422       bless --setBoot --folder $InstallDir/$TargetDir --file $InstallDir/$TargetDir/$Refind
 423    fi
 424    if [[ $? != 0 ]] ; then
 425       Problems=1
 426    fi
 427    if [[ -f /Library/StartupItems/rEFItBlesser || -d /Library/StartupItems/rEFItBlesser ]] ; then
 428       echo
 429       echo "/Library/StartupItems/rEFItBlesser found!"
 430       echo "This program is part of rEFIt, and will cause rEFInd to fail to work after"
 431       echo -n "its first boot. Do you want to remove rEFItBlesser (Y/N)? "
 432       ReadYesNo
 433       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 434          echo "Deleting /Library/StartupItems/rEFItBlesser..."
 435          rm -r /Library/StartupItems/rEFItBlesser
 436       else
 437          echo "Not deleting rEFItBlesser."
 438       fi
 439    fi
 440    echo
 441    echo "WARNING: If you have an Advanced Format disk, *DO NOT* attempt to check the"
 442    echo "bless status with 'bless --info', since this is known to cause disk corruption"
 443    echo "on some systems!!"
 444    echo
 445 } # InstallOnOSX()
 446
 447
 448 #
 449 # Now a series of Linux support functions....
 450 #
 451
 452 # Check for evidence that we're running in Secure Boot mode. If so, and if
 453 # appropriate options haven't been set, warn the user and offer to abort.
 454 # If we're NOT in Secure Boot mode but the user HAS specified the --shim
 455 # or --localkeys option, warn the user and offer to abort.
 456 #
 457 # FIXME: Although I checked the presence (and lack thereof) of the
 458 # /sys/firmware/efi/vars/SecureBoot* files on my Secure Boot test system
 459 # before releasing this script, I've since found that they are at least
 460 # sometimes present when Secure Boot is absent. This means that the first
 461 # test can produce false alarms. A better test is highly desirable.
 462 CheckSecureBoot() {
 463    VarFile=`ls -d /sys/firmware/efi/vars/SecureBoot* 2> /dev/null`
 464    if [[ -n $VarFile  && $TargetDir != '/EFI/BOOT' && $ShimSource == "none" ]] ; then
 465       echo ""
 466       echo "CAUTION: Your computer appears to support Secure Boot, but you haven't"
 467       echo "specified a valid shim.efi file source. If you've disabled Secure Boot and"
 468       echo "intend to leave it disabled, this is fine; but if Secure Boot is active, the"
 469       echo "resulting installation won't boot. You can read more about this topic at"
 470       echo "http://www.rodsbooks.com/refind/secureboot.html."
 471       echo ""
 472       echo -n "Do you want to proceed with installation (Y/N)? "
 473       ReadYesNo
 474       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 475          echo "OK; continuing with the installation..."
 476       else
 477          exit 0
 478       fi
 479    fi
 480
 481    if [[ $ShimSource != "none" && ! -n $VarFile ]] ; then
 482       echo ""
 483       echo "You've specified installing using a shim.efi file, but your computer does not"
 484       echo "appear to be running in Secure Boot mode. Although installing in this way"
 485       echo "should work, it's unnecessarily complex. You may continue, but unless you"
 486       echo "plan to enable Secure Boot, you should consider stopping and omitting the"
 487       echo "--shim option. You can read more about this topic at"
 488       echo "http://www.rodsbooks.com/refind/secureboot.html."
 489       echo ""
 490       echo -n "Do you want to proceed with installation (Y/N)? "
 491       ReadYesNo
 492       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 493          echo "OK; continuing with the installation..."
 494       else
 495          exit 0
 496       fi
 497    fi
 498
 499    if [[ $LocalKeys != 0 && ! -n $VarFile ]] ; then
 500       echo ""
 501       echo "You've specified re-signing your rEFInd binaries with locally-generated keys,"
 502       echo "but your computer does not appear to be running in Secure Boot mode. The"
 503       echo "keys you generate will be useless unless you enable Secure Boot. You may"
 504       echo "proceed with this installation, but before you do so, you may want to read"
 505       echo "more about it at http://www.rodsbooks.com/refind/secureboot.html."
 506       echo ""
 507       echo -n "Do you want to proceed with installation (Y/N)? "
 508       ReadYesNo
 509       if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 510          echo "OK; continuing with the installation..."
 511       else
 512          exit 0
 513       fi
 514    fi
 515
 516 } # CheckSecureBoot()
 517
 518 # Check for the presence of locally-generated keys from a previous installation in
 519 # $EtcKeysDir (/etc/refind.d/keys). If they're not present, generate them using
 520 # openssl.
 521 GenerateKeys() {
 522    PrivateKey=$EtcKeysDir/$LocalKeysBase.key
 523    CertKey=$EtcKeysDir/$LocalKeysBase.crt
 524    DerKey=$EtcKeysDir/$LocalKeysBase.cer
 525    OpenSSL=`which openssl 2> /dev/null`
 526
 527    # Do the work only if one or more of the necessary keys is missing
 528    # TODO: Technically, we don't need the DerKey; but if it's missing and openssl
 529    # is also missing, this will fail. This could be improved.
 530    if [[ ! -f $PrivateKey || ! -f $CertKey || ! -f $DerKey ]] ; then
 531       echo "Generating a fresh set of local keys...."
 532       mkdir -p $EtcKeysDir
 533       chmod 0700 $EtcKeysDir
 534       if [[ ! -x $OpenSSL ]] ; then
 535          echo "Can't find openssl, which is required to create your private signing keys!"
 536          echo "Aborting!"
 537          exit 1
 538       fi
 539       if [[ -f $PrivateKey ]] ; then
 540          echo "Backing up existing $PrivateKey"
 541          cp -f $PrivateKey $PrivateKey.backup 2> /dev/null
 542       fi
 543       if [[ -f $CertKey ]] ; then
 544          echo "Backing up existing $CertKey"
 545          cp -f $CertKey $CertKey.backup 2> /dev/null
 546       fi
 547       if [[ -f $DerKey ]] ; then
 548          echo "Backing up existing $DerKey"
 549          cp -f $DerKey $DerKey.backup 2> /dev/null
 550       fi
 551       $OpenSSL req -new -x509 -newkey rsa:2048 -keyout $PrivateKey -out $CertKey \
 552                    -nodes -days 3650 -subj "/CN=Locally-generated rEFInd key/"
 553       $OpenSSL x509 -in $CertKey -out $DerKey -outform DER
 554       chmod 0600 $PrivateKey
 555    else
 556       echo "Using existing local keys...."
 557    fi
 558 }
 559
 560 # Sign a single binary. Requires parameters:
 561 #   $1 = source file
 562 #   $2 = destination file
 563 # Also assumes that the SBSign, PESign, UseSBSign, UsePESign, and various key variables are set
 564 # appropriately.
 565 # Aborts script on error
 566 SignOneBinary() {
 567    $SBSign --key $PrivateKey --cert $CertKey --output $2 $1
 568    if [[ $? != 0 ]] ; then
 569       echo "Problem signing the binary $1! Aborting!"
 570       exit 1
 571    fi
 572 }
 573
 574 # Re-sign the x86-64 binaries with a locally-generated key, First look for appropriate
 575 # key files in $EtcKeysDir. If they're present, use them to re-sign the binaries. If
 576 # not, try to generate new keys and store them in $EtcKeysDir.
 577 ReSignBinaries() {
 578    SBSign=`which sbsign 2> /dev/null`
 579    echo "Found sbsign at $SBSign"
 580    TempDir="/tmp/refind_local"
 581    if [[ ! -x $SBSign ]] ; then
 582       echo "Can't find sbsign, which is required to sign rEFInd with your own keys!"
 583       echo "Aborting!"
 584       exit 1
 585    fi
 586    GenerateKeys
 587    mkdir -p $TempDir/drivers_x64
 588    cp $RefindDir/refind.conf-sample $TempDir 2> /dev/null
 589    cp $ThisDir/refind.conf-sample $TempDir 2> /dev/null
 590    cp $RefindDir/refind_ia32.efi $TempDir 2> /dev/null
 591    cp -a $RefindDir/drivers_ia32 $TempDir 2> /dev/null
 592    cp -a $ThisDir/drivers_ia32 $TempDir 2> /dev/null
 593    SignOneBinary $RefindDir/refind_x64.efi $TempDir/refind_x64.efi
 594    for Driver in `ls $RefindDir/drivers_x64/*.efi $ThisDir/drivers_x64/*.efi 2> /dev/null` ; do
 595       TempName=`basename $Driver`
 596       SignOneBinary $Driver $TempDir/drivers_x64/$TempName
 597    done
 598    RefindDir=$TempDir
 599    DeleteRefindDir=1
 600 }
 601
 602 # Identifies the ESP's location (/boot or /boot/efi, or these locations under
 603 # the directory specified by --root); aborts if the ESP isn't mounted at
 604 # either location.
 605 # Sets InstallDir to the ESP mount point.
 606 FindLinuxESP() {
 607    EspLine=`df $RootDir/boot/efi 2> /dev/null | grep boot/efi`
 608    if [[ ! -n $EspLine ]] ; then
 609       EspLine=`df $RootDir/boot | grep boot`
 610    fi
 611    InstallDir=`echo $EspLine | cut -d " " -f 6`
 612    if [[ -n $InstallDir ]] ; then
 613       EspFilesystem=`grep $InstallDir /etc/mtab | uniq | cut -d " " -f 3`
 614    fi
 615    if [[ $EspFilesystem != 'vfat' ]] ; then
 616       echo "$RootDir/boot/efi doesn't seem to be on a VFAT filesystem. The ESP must be"
 617       echo "mounted at $RootDir/boot or $RootDir/boot/efi and it must be VFAT! Aborting!"
 618       exit 1
 619    fi
 620    echo "ESP was found at $InstallDir using $EspFilesystem"
 621 } # FindLinuxESP
 622
 623 # Uses efibootmgr to add an entry for rEFInd to the EFI's NVRAM.
 624 # If this fails, sets Problems=1
 625 AddBootEntry() {
 626    InstallIt="0"
 627    Efibootmgr=`which efibootmgr 2> /dev/null`
 628    if [[ $Efibootmgr ]] ; then
 629       InstallDisk=`grep $InstallDir /etc/mtab | cut -d " " -f 1 | cut -c 1-8`
 630       PartNum=`grep $InstallDir /etc/mtab | cut -d " " -f 1 | cut -c 9-10`
 631       EntryFilename=$TargetDir/$Refind
 632       EfiEntryFilename=`echo ${EntryFilename//\//\\\}`
 633       EfiEntryFilename2=`echo ${EfiEntryFilename} | sed s/\\\\\\\\/\\\\\\\\\\\\\\\\/g`
 634       ExistingEntry=`$Efibootmgr -v | grep -i $EfiEntryFilename2`
 635
 636       if [[ $ExistingEntry ]] ; then
 637          ExistingEntryBootNum=`echo $ExistingEntry | cut -c 5-8`
 638          FirstBoot=`$Efibootmgr | grep BootOrder | cut -c 12-15`
 639          if [[ $ExistingEntryBootNum != $FirstBoot ]] ; then
 640             echo "An existing rEFInd boot entry exists, but isn't set as the default boot"
 641             echo "manager. The boot order is being adjusted to make rEFInd the default boot"
 642             echo "manager. If this is NOT what you want, you should use efibootmgr to"
 643             echo "manually adjust your EFI's boot order."
 644             $Efibootmgr -b $ExistingEntryBootNum -B &> /dev/null
 645             InstallIt="1"
 646          fi
 647       else
 648          InstallIt="1"
 649       fi
 650
 651       if [[ $InstallIt == "1" ]] ; then
 652          echo "Installing it!"
 653          $Efibootmgr -c -l $EfiEntryFilename -L "rEFInd Boot Manager" -d $InstallDisk -p $PartNum &> /dev/null
 654          if [[ $? != 0 ]] ; then
 655             EfibootmgrProblems=1
 656             Problems=1
 657          fi
 658       fi
 659
 660    else # efibootmgr not found
 661       EfibootmgrProblems=1
 662       Problems=1
 663    fi
 664
 665    if [[ $EfibootmgrProblems ]] ; then
 666       echo
 667       echo "ALERT: There were problems running the efibootmgr program! You may need to"
 668       echo "rename the $Refind binary to the default name (EFI/boot/bootx64.efi"
 669       echo "on x86-64 systems or EFI/boot/bootia32.efi on x86 systems) to have it run!"
 670       echo
 671    fi
 672 } # AddBootEntry()
 673
 674 # Create a minimal/sample refind_linux.conf file in /boot.
 675 GenerateRefindLinuxConf() {
 676    if [[ -f $RLConfFile ]] ; then
 677       echo "Existing $RLConfFile found; not overwriting."
 678    else
 679       if [[ -f "$RootDir/etc/default/grub" ]] ; then
 680          # We want the default options used by the distribution, stored here....
 681          source "$RootDir/etc/default/grub"
 682       fi
 683       RootFS=`df $RootDir | grep dev | cut -f 1 -d " "`
 684       StartOfDevname=`echo $RootFS | cut -b 1-7`
 685       if [[ $StartOfDevname == "/dev/sd" || $StartOfDevName == "/dev/hd" ]] ; then
 686          # Identify root filesystem by UUID rather than by device node, if possible
 687          Uuid=`blkid -o export $RootFS 2> /dev/null | grep UUID=`
 688          if [[ -n $Uuid ]] ; then
 689             RootFS=$Uuid
 690          fi
 691       fi
 692       DefaultOptions="$GRUB_CMDLINE_LINUX $GRUB_CMDLINE_LINUX_DEFAULT"
 693       echo "\"Boot with standard options\" \"ro root=$RootFS $DefaultOptions \"" > $RLConfFile
 694       echo "\"Boot to single-user mode\"   \"ro root=$RootFS $DefaultOptions single\"" >> $RLConfFile
 695       echo "\"Boot with minimal options\"  \"ro root=$RootFS\"" >> $RLConfFile
 696    fi
 697 }
 698
 699 # Set varaibles for installation in EFI/BOOT directory
 700 SetVarsForBoot() {
 701    TargetDir="/EFI/BOOT"
 702    if [[ $ShimSource == "none" ]] ; then
 703       TargetX64="bootx64.efi"
 704       TargetIA32="bootia32.efi"
 705    else
 706       TargetX64="grubx64.efi"
 707       TargetIA32="bootia32.efi"
 708       TargetShim="bootx64.efi"
 709    fi
 710 } # SetFilenamesForBoot()
 711
 712 # Set variables for installation in EFI/Microsoft/Boot directory
 713 SetVarsForMsBoot() {
 714    TargetDir="/EFI/Microsoft/Boot"
 715    if [[ $ShimSource == "none" ]] ; then
 716       TargetX64="bootmgfw.efi"
 717    else
 718       TargetX64="grubx64.efi"
 719       TargetShim="bootmgfw.efi"
 720    fi
 721 }
 722
 723 # TargetDir defaults to /EFI/refind; however, this function adjusts it as follows:
 724 # - If an existing refind.conf is available in /EFI/BOOT or /EFI/Microsoft/Boot,
 725 #   install to that directory under the suitable name; but DO NOT do this if
 726 #   refind.conf is also in /EFI/refind.
 727 # - If booted in BIOS mode and the ESP lacks any other EFI files, install to
 728 #   /EFI/BOOT
 729 # - If booted in BIOS mode and there's no refind.conf file and there is a
 730 #   /EFI/Microsoft/Boot/bootmgfw.efi file, move it down one level and
 731 #   install under that name, "hijacking" the Windows boot loader filename
 732 DetermineTargetDir() {
 733    Upgrade=0
 734
 735    if [[ -f $InstallDir/EFI/BOOT/refind.conf ]] ; then
 736       SetVarsForBoot
 737       Upgrade=1
 738    fi
 739    if [[ -f $InstallDir/EFI/Microsoft/Boot/refind.conf ]] ; then
 740       SetVarsForMsBoot
 741       Upgrade=1
 742    fi
 743    if [[ -f $InstallDir/EFI/refind/refind.conf ]] ; then
 744       TargetDir="/EFI/refind"
 745       Upgrade=1
 746    fi
 747    if [[ $Upgrade == 1 ]] ; then
 748       echo "Found rEFInd installation in $InstallDir$TargetDir; upgrading it."
 749    fi
 750
 751    if [[ ! -d /sys/firmware/efi && $Upgrade == 0 ]] ; then     # BIOS-mode
 752       FoundEfiFiles=`find $InstallDir/EFI/BOOT -name "*.efi" 2> /dev/null`
 753       FoundConfFiles=`find $InstallDir -name "refind\.conf" 2> /dev/null`
 754       if [[ ! -n $FoundConfFiles && -f $InstallDir/EFI/Microsoft/Boot/bootmgfw.efi ]] ; then
 755          mv -n $InstallDir/EFI/Microsoft/Boot/bootmgfw.efi $InstallDir/EFI/Microsoft &> /dev/null
 756          SetVarsForMsBoot
 757          echo "Running in BIOS mode with a suspected Windows installation; moving boot loader"
 758          echo "files so as to install to $InstallDir$TargetDir."
 759       elif [[ ! -n $FoundEfiFiles ]] ; then  # In BIOS mode and no default loader; install as default loader
 760          SetVarsForBoot
 761          echo "Running in BIOS mode with no existing default boot loader; installing to"
 762          echo $InstallDir$TargetDir
 763       else
 764          echo "Running in BIOS mode with an existing default boot loader; backing it up and"
 765          echo "installing rEFInd in its place."
 766          if [[ -d $InstallDir/EFI/BOOT-rEFIndBackup ]] ; then
 767             echo ""
 768             echo "Caution: An existing backup of a default boot loader exists! If the current"
 769             echo "default boot loader and the backup are different boot loaders, the current"
 770             echo "one will become inaccessible."
 771             echo ""
 772             echo -n "Do you want to proceed with installation (Y/N)? "
 773             ReadYesNo
 774             if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 775                echo "OK; continuing with the installation..."
 776             else
 777                exit 0
 778             fi
 779          fi
 780          mv -n $InstallDir/EFI/BOOT $InstallDir/EFI/BOOT-rEFIndBackup
 781          SetVarsForBoot
 782       fi
 783    fi # BIOS-mode
 784 } # DetermineTargetDir()
 785
 786 # Controls rEFInd installation under Linux.
 787 # Sets Problems=1 if something goes wrong.
 788 InstallOnLinux() {
 789    echo "Installing rEFInd on Linux...."
 790    modprobe efivars &> /dev/null
 791    if [[ $TargetDir == "/EFI/BOOT" ]] ; then
 792       MountDefaultTarget
 793    else
 794       FindLinuxESP
 795       DetermineTargetDir
 796    fi
 797    CpuType=`uname -m`
 798    if [[ $CpuType == 'x86_64' ]] ; then
 799       Platform="EFI64"
 800    elif [[ ($CpuType == 'i386' || $CpuType == 'i486' || $CpuType == 'i586' || $CpuType == 'i686') ]] ; then
 801       Platform="EFI32"
 802       # If we're in EFI mode, do some sanity checks, and alert the user or even
 803       # abort. Not in BIOS mode, though, since that could be used on an emergency
 804       # disc to try to recover a troubled Linux installation.
 805       if [[ -d /sys/firmware/efi ]] ; then
 806          if [[ $ShimSource != "none" && $TargetDir != "/BOOT/EFI" ]] ; then
 807             echo ""
 808             echo "CAUTION: Neither rEFInd nor shim currently supports 32-bit systems, so you"
 809             echo "should not use the --shim option to install on such systems. Aborting!"
 810             echo ""
 811             exit 1
 812          fi
 813          echo
 814          echo "CAUTION: This Linux installation uses a 32-bit kernel. 32-bit EFI-based"
 815          echo "computers are VERY RARE. If you've installed a 32-bit version of Linux"
 816          echo "on a 64-bit computer, you should manually install the 64-bit version of"
 817          echo "rEFInd. If you're installing on a Mac, you should do so from OS X. If"
 818          echo "you're positive you want to continue with this installation, answer 'Y'"
 819          echo "to the following question..."
 820          echo
 821          echo -n "Are you sure you want to continue (Y/N)? "
 822          ReadYesNo
 823          if [[ $YesNo == "Y" || $YesNo == "y" ]] ; then
 824             echo "OK; continuing with the installation..."
 825          else
 826             exit 0
 827          fi
 828       fi # in EFI mode
 829    else
 830       echo "Unknown CPU type '$CpuType'; aborting!"
 831       exit 1
 832    fi
 833
 834    if [[ $LocalKeys == 1 ]] ; then
 835       ReSignBinaries
 836    fi
 837
 838    CheckSecureBoot
 839    CopyRefindFiles
 840    if [[ $TargetDir != "/EFI/BOOT" && $TargetDir != "/EFI/Microsoft/Boot" ]] ; then
 841       AddBootEntry
 842       GenerateRefindLinuxConf
 843    fi
 844 } # InstallOnLinux()
 845
 846 #
 847 # The main part of the script. Sets a few environment variables,
 848 # performs a few startup checks, and then calls functions to
 849 # install under OS X or Linux, depending on the detected platform.
 850 #
 851
 852 OSName=`uname -s`
 853 GetParams $@
 854 ThisDir="$( cd -P "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 855 RefindDir="$ThisDir/refind"
 856 ThisScript="$ThisDir/`basename $0`"
 857 if [[ `whoami` != "root" ]] ; then
 858    echo "Not running as root; attempting to elevate privileges via sudo...."
 859    sudo $ThisScript "$@"
 860    if [[ $? != 0 ]] ; then
 861       echo "This script must be run as root (or using sudo). Exiting!"
 862       exit 1
 863    else
 864       exit 0
 865    fi
 866 fi
 867 CheckForFiles
 868 if [[ $OSName == 'Darwin' ]] ; then
 869    if [[ $ShimSource != "none" ]] ; then
 870       echo "The --shim option is not supported on OS X! Exiting!"
 871       exit 1
 872    fi
 873    if [[ $LocalKeys != 0 ]] ; then
 874       echo "The --localkeys option is not supported on OS X! Exiting!"
 875       exit 1
 876    fi
 877    InstallOnOSX $1
 878 elif [[ $OSName == 'Linux' ]] ; then
 879    InstallOnLinux
 880 else
 881    echo "Running on unknown OS; aborting!"
 882 fi
 883
 884 if [[ $Problems ]] ; then
 885    echo
 886    echo "ALERT:"
 887    echo "Installation has completed, but problems were detected. Review the output for"
 888    echo "error messages and take corrective measures as necessary. You may need to"
 889    echo "re-run this script or install manually before rEFInd will work."
 890    echo
 891 else
 892    echo
 893    echo "Installation has completed successfully."
 894    echo
 895 fi
 896
 897 if [[ $UnmountEsp ]] ; then
 898    echo "Unmounting install dir"
 899    umount $InstallDir
 900 fi
 901
 902 if [[ $InstallDir == /tmp/refind_install ]] ; then
 903 #   sleep 5
 904    rmdir $InstallDir
 905 fi